文献类型：期刊文献

英文题名：Hurst parameter for security evaluation of LAN traffic

作者：Yan, Ruoyu[1]; Wang, Yingfeng[1]

第一作者：颜若愚

通讯作者：Yan, R.

机构：[1] College of Computer and Information Engineering, Henan University of Economics and Law, Zhengzhou, Henan Province, 450002, China

第一机构：河南财经政法大学计算机与信息工程学院

通讯机构：[1]College of Computer and Information Engineering, Henan University of Economics and Law, Zhengzhou, Henan Province, 450002, China|[1048412]河南财经政法大学计算机与信息工程学院;[10484]河南财经政法大学;

年份：2012

卷号：11

期号：2

起止页码：269-275

外文期刊名：Information Technology Journal

收录：EI(收录号：20120814801196);Scopus(收录号：2-s2.0-84863136363)

语种：英文

外文关键词：Anomaly detection - Iterative methods - Local area networks - Parameter estimation - Time domain analysis

摘要：Self-similarity analysis and anomaly detection in networks are research focus in the traffic analysis and network security community. How to use Hurst parameter estimated accurately to detect traffic anomaly timely is a meaningful work. In the study, based on traffic self-similarity, an effective scheme is proposed to detect and evaluate LAN traffic anomaly. Firstly, iterative estimation method is used to estimate Hurst parameters of four traffic metrics in real time. Then the Hurst values are compared with confidence intervals of normal values to detect anomaly in four kinds of traffics. Finally the anomaly detection results are integrated and normalized to evaluate general security situation of LAN traffic. The simulation results show that iterative estimation of Hurst value has faster speed, higher accuracy and smaller confidence intervals than variance-time plots, a widely used time-domain estimation method and than a new whittle estimator method, which is better than wavelet analysis method. On the other hand, experiments on real LAN traffic show that the method proposed in the paper can detect LAN traffic anomaly and display security situation of LAN traffic accurately. ? 2012 Asian Network for Scientific Information.